Djibril Mounkoro

**Name of the Vulnerable Software and Affected Versions** HestiaCP versions prior to 1.9.5 **Description** An authenticated OS command injection allows low-privilege users to execute arbitrary commands as root. The issue stems from insufficient input validation in the `is dns record format valid()` function combined with unsafe eval-based parsing in the `update domain zone()` function. By injecting a single-quote character into unvalidated DNS record types, an attacker can prematurely close a variable assignment string and achieve full root code execution on the host during the creation of a DNS record. **Recommendations** Update HestiaCP to version 1.9.5 or later.

**Name of the Vulnerable Software and Affected Versions** HestiaCP versions prior to 1.9.5 **Description** An authenticated low-privilege user can perform a stored cross-site scripting attack by creating a DNS record containing a double-quote followed by a script payload in the value field. The issue occurs because the application does not use the `htmlspecialchars()` function to encode the DNS record value when it is rendered within the `data-sort-value` HTML attribute in the 'list dns rec.php' endpoint. This allows the injected script to execute in the browser of any user who views the DNS record list, including those with administrator privileges. **Recommendations** Update HestiaCP to version 1.9.5 or later.

**Name of the Vulnerable Software and Affected Versions** CyberPanel versions prior to 2.4.4 **Description** A stored cross-site scripting issue exists in the AI Scanner dashboard. The endpoint '/api/ai-scanner/callback' does not require authentication, allowing unauthenticated attackers to inject malicious JavaScript by overwriting the `findings json` field of ScanHistory records. This script executes within an administrator's authenticated session upon visiting the AI Scanner dashboard, which can be used to issue same-origin requests to plant cron jobs and achieve remote code execution on the server. **Recommendations** Update to version 2.4.4 or later.

**Name of the Vulnerable Software and Affected Versions** CyberPanel versions prior to 2.4.4 **Description** An authentication bypass in the AI Scanner worker API endpoints allows unauthenticated remote attackers to write arbitrary data to the database. This is achieved by sending requests to the endpoints '/api/ai-scanner/status-webhook' and '/api/ai-scanner/callback'. Exploitation of this flaw can lead to denial of service through storage exhaustion, corruption of scan history records, and pollution of database fields with malicious data. **Recommendations** Update to version 2.4.4 or later.